7ff5c9a086af1e0a873f89114e0e482417627a6de706a0ed5e68f8fdc7852cbf

Sharing

Copy URL Twitter E-mail

General

Target
7ff5c9a086af1e0a873f89114e0e482417627a6de706a0ed5e68f8fdc7852cbf
Size 894KB
Sample260916-pyjwys1aph
SHA256 7ff5c9a086af1e0a873f89114e0e482417627a6de706a0ed5e68f8fdc7852cbf
MD5 1dfd076c98fc7b090b8e7507439d0885
SHA1 6a498c826fd9d71b41e770c6a82740c7f4b1d5a8
SHA512 e13819879f777f563d2931f8d695cbdff6d7a73e06ec1b74af2bea58508f2344eb4b560e2e5f95bbf91011ee51624c5a5912cc1904c1cc8325c4aa854c4ff907
SSDEEP 24576:A93JaahnmQaSV8R3l6Z5WGc4DYsHQDy6g3P0zAk79oOHh7k:rahm5SO9l6Z5WGc4DYsHQDy6g3P0zAkN
TLSH
T1F6156D13D6548AA9D57AE134CDC08603C9B374822726B9CF02A857047F6BEF47B7DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7ff5c9a086af1e0a873f89114e0e482417627a6de706a0ed5e68f8fdc7852cbf

File Explorer

7ff5c9a086af1e0a873f89114e0e482417627a6de706a0ed5e68f8fdc7852cbf

.dll 894KB

7ff5c9a086af1e0a873f89114e0e482417627a6de706a0ed5e68f8fdc7852cbf

IMPHASH 6de2c6d734ad6ff8f08ba2a832ee52f3
SHA256 7ff5c9a086af1e0a873f89114e0e482417627a6de706a0ed5e68f8fdc7852cbf
MD5 1dfd076c98fc7b090b8e7507439d0885
SHA1 6a498c826fd9d71b41e770c6a82740c7f4b1d5a8
SHA512 e13819879f777f563d2931f8d695cbdff6d7a73e06ec1b74af2bea58508f2344eb4b560e2e5f95bbf91011ee51624c5a5912cc1904c1cc8325c4aa854c4ff907
SSDEEP 24576:A93JaahnmQaSV8R3l6Z5WGc4DYsHQDy6g3P0zAk79oOHh7k:rahm5SO9l6Z5WGc4DYsHQDy6g3P0zAkN
TLSH
T1F6156D13D6548AA9D57AE134CDC08603C9B374822726B9CF02A857047F6BEF47B7DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

316560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

vulkan-1.dll.pdb

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesExW GetFileSize GetFileSizeEx GetFileType GetFullPathNameA GetLastError GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemTimeAsFileTime GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

advapi32

GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation OpenProcessToken RegCloseKey RegEnumValueA RegOpenKeyExA RegQueryValueExA

cfgmgr32

CM_Get_Child CM_Get_DevNode_Registry_PropertyW CM_Get_DevNode_Status CM_Get_Device_IDW CM_Get_Device_ID_ListW CM_Get_Device_ID_List_SizeW CM_Get_Sibling CM_Locate_DevNodeW CM_Open_DevNode_Key

vkAcquireNextImage2KHR vkAcquireNextImageKHR vkAllocateCommandBuffers injection_initialize injection_terminate te vkBindBufferMemory vkBindBufferMemory2 vkBindImageMemory vkBindImageMemory2 vkCmdBeginQuery vkCmdBeginRenderPass vkCmdBeginRenderPass2 vkCmdBeginRendering vkCmdBindDescriptorSets vkCmdBindDescriptorSets2 vkCmdBindIndexBuffer vkCmdBindIndexBuffer2 vkCmdBindPipeline vkCmdBindVertexBuffers vkCmdBindVertexBuffers2 vkCmdBlitImage vkCmdBlitImage2 vkCmdClearAttachments vkCmdClearColorImage vkCmdClearDepthStencilImage vkCmdCopyBuffer vkCmdCopyBuffer2 vkCmdCopyBufferToImage vkCmdCopyBufferToImage2 vkCmdCopyImage vkCmdCopyImage2 vkCmdCopyImageToBuffer vkCmdCopyImageToBuffer2 vkCmdCopyQueryPoolResults vkCmdDispatch vkCmdDispatchBase vkCmdDispatchIndirect vkCmdDraw vkCmdDrawIndexed vkCmdDrawIndexedIndirect vkCmdDrawIndexedIndirectCount vkCmdDrawIndirect vkCmdDrawIndirectCount vkCmdEndQuery vkCmdEndRenderPass vkCmdEndRenderPass2 vkCmdEndRendering vkCmdExecuteCommands vkCmdFillBuffer vkCmdNextSubpass vkCmdNextSubpass2 vkCmdPipelineBarrier vkCmdPipelineBarrier2 vkCmdPushConstants vkCmdPushConstants2 vkCmdPushDescriptorSet vkCmdPushDescriptorSet2 vkCmdPushDescriptorSetWithTemplate vkCmdPushDescriptorSetWithTemplate2 vkCmdResetEvent vkCmdResetEvent2 vkCmdResetQueryPool vkCmdResolveImage vkCmdResolveImage2 vkCmdSetBlendConstants vkCmdSetCullMode vkCmdSetDepthBias vkCmdSetDepthBiasEnable vkCmdSetDepthBounds vkCmdSetDepthBoundsTestEnable vkCmdSetDepthCompareOp vkCmdSetDepthTestEnable vkCmdSetDepthWriteEnable vkCmdSetDeviceMask vkCmdSetEvent vkCmdSetEvent2 vkCmdSetFrontFace vkCmdSetLineStipple vkCmdSetLineWidth vkCmdSetPrimitiveRestartEnable vkCmdSetPrimitiveTopology vkCmdSetRasterizerDiscardEnable vkCmdSetRenderingAttachmentLocations vkCmdSetRenderingInputAttachmentIndices vkCmdSetScissor vkCmdSetScissorWithCount vkCmdSetStencilCompareMask vkCmdSetStencilOp vkCmdSetStencilReference vkCmdSetStencilTestEnable vkCmdSetStencilWriteMask vkCmdSetViewport vkCmdSetViewportWithCount vkCmdUpdateBuffer vkCmdWaitEvents vkCmdWaitEvents2 vkCmdWriteTimestamp vkCmdWriteTimestamp2 vkCopyImageToImage vkCopyImageToMemory vkCopyMemoryToImage vkCreateBuffer vkCreateBufferView vkCreateCommandPool vkCreateComputePipelines vkCreateDescriptorPool vkCreateDescriptorSetLayout vkCreateDescriptorUpdateTemplate vkCreateDevice vkCreateDisplayModeKHR vkCreateDisplayPlaneSurfaceKHR vkCreateEvent vkCreateFence vkCreateFramebuffer vkCreateGraphicsPipelines vkCreateHeadlessSurfaceEXT vkCreateImage vkCreateImageView vkCreateInstance vkCreatePipelineCache vkCreatePipelineLayout vkCreatePrivateDataSlot vkCreateQueryPool vkCreateRenderPass vkCreateRenderPass2 vkCreateSampler vkCreateSamplerYcbcrConversion vkCreateSemaphore vkCreateShaderModule vkCreateSharedSwapchainsKHR vkCreateSwapchainKHR vkCreateWin32SurfaceKHR vkDestroyBuffer vkDestroyBufferView vkDestroyCommandPool vkDestroyDescriptorPool vkDestroyDescriptorSetLayout vkDestroyDescriptorUpdateTemplate vkDestroyDevice vkDestroyEvent vkDestroyFence vkDestroyFramebuffer vkDestroyImage vkDestroyImageView vkDestroyInstance vkDestroyPipeline vkDestroyPipelineCache vkDestroyPipelineLayout vkDestroyPrivateDataSlot vkDestroyQueryPool vkDestroyRenderPass vkDestroySampler vkDestroySamplerYcbcrConversion vkDestroySemaphore vkDestroyShaderModule vkDestroySurfaceKHR vkDestroySwapchainKHR vkDeviceWaitIdle vkEndCommandBuffer vkEnumerateDeviceExtensionProperties vkEnumerateDeviceLayerProperties vkEnumerateInstanceExtensionProperties vkEnumerateInstanceLayerProperties vkEnumerateInstanceVersion vkEnumeratePhysicalDeviceGroups vkEnumeratePhysicalDevices vkFlushMappedMemoryRanges vkFreeCommandBuffers vkFreeDescriptorSets vkFreeMemory vkGetBufferDeviceAddress vkGetBufferMemoryRequirements vkGetBufferMemoryRequirements2 vkGetBufferOpaqueCaptureAddress vkGetDescriptorSetLayoutSupport vkGetDeviceBufferMemoryRequirements vkGetDeviceGroupPeerMemoryFeatures vkGetDeviceGroupPresentCapabilitiesKHR vkGetDeviceGroupSurfacePresentModesKHR vkGetDeviceImageMemoryRequirements vkGetDeviceImageSparseMemoryRequirements vkGetDeviceImageSubresourceLayout vkGetDeviceMemoryCommitment vkGetDeviceMemoryOpaqueCaptureAddress vkGetDeviceProcAddr vkGetDeviceQueue vkGetDeviceQueue2 vkGetDisplayModeProperties2KHR vkGetDisplayModePropertiesKHR vkGetDisplayPlaneCapabilities2KHR vkGetDisplayPlaneCapabilitiesKHR vkGetDisplayPlaneSupportedDisplaysKHR vkGetEventStatus vkGetFenceStatus vkGetImageMemoryRequirements vkGetImageMemoryRequirements2 vkGetImageSparseMemoryRequirements vkGetImageSparseMemoryRequirements2 vkGetImageSubresourceLayout vkGetImageSubresourceLayout2 vkGetInstanceProcAddr vkGetPhysicalDeviceDisplayPlaneProperties2KHR vkGetPhysicalDeviceDisplayPlanePropertiesKHR vkGetPhysicalDeviceDisplayProperties2KHR vkGetPhysicalDeviceDisplayPropertiesKHR vkGetPhysicalDeviceExternalBufferProperties vkGetPhysicalDeviceExternalFenceProperties vkGetPhysicalDeviceExternalSemaphoreProperties vkGetPhysicalDeviceFeatures vkGetPhysicalDeviceFeatures2 vkGetPhysicalDeviceFormatProperties vkGetPhysicalDeviceFormatProperties2 vkGetPhysicalDeviceImageFormatProperties vkGetPhysicalDeviceImageFormatProperties2 vkGetPhysicalDeviceMemoryProperties vkGetPhysicalDeviceMemoryProperties2 vkGetPhysicalDevicePresentRectanglesKHR vkGetPhysicalDeviceProperties vkGetPhysicalDeviceProperties2 vkGetPhysicalDeviceQueueFamilyProperties vkGetPhysicalDeviceQueueFamilyProperties2 vkGetPhysicalDeviceSparseImageFormatProperties vkGetPhysicalDeviceSparseImageFormatProperties2 vkGetPhysicalDeviceSurfaceCapabilities2KHR vkGetPhysicalDeviceSurfaceCapabilitiesKHR vkGetPhysicalDeviceSurfaceFormats2KHR vkGetPhysicalDeviceSurfaceFormatsKHR vkGetPhysicalDeviceSurfacePresentModesKHR vkGetPhysicalDeviceSurfaceSupportKHR vkGetPhysicalDeviceToolProperties vkGetPhysicalDeviceWin32PresentationSupportKHR vkGetPipelineCacheData vkGetPrivateData vkGetQueryPoolResults vkGetRenderAreaGranularity vkGetRenderingAreaGranularity vkGetSemaphoreCounterValue vkGetSwapchainImagesKHR vkInvalidateMappedMemoryRanges vkMapMemory vkMapMemory2 vkMergePipelineCaches vkQueueBindSparse vkQueuePresentKHR vkQueueSubmit vkQueueSubmit2 vkQueueWaitIdle vkResetCommandBuffer vkResetCommandPool vkResetDescriptorPool vkResetEvent vkResetFences vkResetQueryPool vkSetEvent vkSetPrivateData vkSignalSemaphore vkTransitionImageLayout vkTrimCommandPool vkUnmapMemory vkUnmapMemory2 vkUpdateDescriptorSetWithTemplate vkUpdateDescriptorSets vkWaitForFences vkWaitSemaphores

Name

.text

Size

588KB

Virtual Size

588KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

264KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

8KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7ff5c9a086af1e0a873f89114e0e482417627a6de706a0ed5e68f8fdc7852cbf

kernel32

advapi32

cfgmgr32

generic